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Summary 


Modern microprocessor technology and display systems make it entirely 
feasible to automate many flight-deck functions previously performed 
manually- There are many real benefits to be derived from automation; the 
question today is not whether a function can be automated, but whether it 
should be, due to the various human factor questions that are raised. It is 
highly questionable whether total system safety is always enhanced by 
allocating functions to automatic devices rather than human operators, and 
there is some reason to believe that flight-deck automation may have already 
passed the point of optimality. This is an age-old question in the human 
factors profession, and there are few guidelines available to the system 
designer. 

This paper presents the state of the art in human factors in flight-deck 
automation, identifies a number of critical problem areas, and offers broc J 
design guidelines. Some automation-related aircraft accidents and incidents 
are discussed as examples of human factors problems in automated flight. 


1. Introduction 


Papers of this sort often begin with the almost mandatory statement that 
in future systems automatic devices will provide for the real-time, moment- 
to-moment control of the process, and that the human operator will be 
relegated to the post of monitor and decisionmaker, keeping watch for 
deviations and failures, and taking over when necessary (see numerous papers 
in Sheridan and Johannsen 1976). This prescription is based on the observa- 
tion that inanimate control devices are extremely good at real-time control, 
but must be backed up by the remarkable flexibility of the human as a super- 
visor and standby controller, in case of breakdown or other unforeseen 
events. 


*Earl L. Wiener is with the Departments of Management Science and 
Industrial Engineering, University of Miami, Coral Gables, Florida 33124. 
He is a visiting research scientist at Ames Research Center under an 
Intergovernmental Personnel Agreement. 



Another virtually mandatory statement is that the numan, for all his 
putative flexibility, is not so good at the monitoring task and is highly 
likely to miss critical signals, as well as to make occasional commissive 
errors. Indeed, the verity of the second statement, supported by endless 
accident and incident reports, tempts designers to "automate human error out 
of the system." The lure is especially great in aviation, where the cost of 
human failure can be so catastrophic. 

Although the authors have no quarrel with the two basic statements, the 
assumption that automation can eliminate human error must be questioned. 

This paper will explore automation of flight-deck functions, the presumed 
benefits and possible pitfalls, and will ask whether it is possible that 
cockpit automation may have already passed its point of optimality. This 
examination is made more urgent by rapid developments in microprocessor 
technology and many present and near-future applications in the cockpit 
(Lovesey 1977; Ropelewski 1979). The question is no longer whether one or 
another function can be automated but, rather, whether it should be. 

Much of what will be said about automation on the flight deck may be 
applied equally well to other large-scale systems (e.g., air traffic 
control and nuclear power generation), and we invite the reader to do so. 
Likewise, much of what has been written about automation in other fields 
could apply to the flight deck; for example, note the many excellent papers 
on process control appearing in Edwards and Lees (1974) and the overview by 
Shackel (1967). 

The very word "automation" is likely to conjure up, at least in the mind 
of the technologically unsophisticated, two rather opposite images, both of 
which can ultimately be shown to be exaggerated, if not incorrect. On the 
negative side, automation is seen as a collection of tyrannical, self-serving 
machines, degrading humans, reducing the work force, bringing wholesale 
unemployment, and, perhaps even worse, offering an "Invitation to a techno- 
logical dictator to sieze power and build a society run by Dr. Strangeloves, 
aided by opportunistic, cold-hearted computer geniuses. The classic Charlie 
Chaplin movie Mod ern Times depicted the subjugation cf industrial man to 
machine, and more recently the popular novels and movies by Michael Crichton 
( Westworld , Terminal Man ) dwelled on the perils or a computer-based society 
gone awry. So far, there is no indication that such a thing has happened, 
or that it will. 

Perhaps equally fallacious is the positive image of automation: quiet, 

unerring, efficient, totally dependable machines, the servant of man, 
eliminating all human error, and offering a safe and cost-effective alterna- 
tive to human frailty and caprice. The traditional dream of traditic '1 
engineers has been to solve the problem of human error by eliminating . s 
source. It is worth noting that the general public appears as skeptical of 
the infallibility of automation as they are fearful of its consequences. 
Witness the endless popular jokes about the announcement over the airliner 
intercom that the plane is being flown entirely by automatic devices. 
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Thus, the authors will shortly present what is popularly called "the 
good news and the bad news" of flight-deck automation, for there are ample 
instances of each. We shall finally attempt to provide some tentative guide- 
lines to the implementation of automatic devices in aircraft. Automation of 
human functions in air traffic control (ATC), weather forecasting, 
dispatching, and maintenance, although vitally important, will not be 
addressed . 


2. Why automate? 


It is trite (though necessary) to say that automation may be a mixed 
blessing in the cockpit. Already there is serious concern about the effect 
of automation on flight-deck performance, workload, and, ultimately, on 
aviation safety (Edwards 1?76, 1977). Questions have arisen from accident 
reports, incident reports (such as NASA's Aviation Safety Reporting System), 
airline training, simulator studies, and our own interviews with crewmembers 
and airline flight managers about such matters as failure detection, manual 
takeover, skills degradation, and even job satisfaction and self-concept of 
pilots and flight engineers operating highly automated equipment. These are 
not new problems, but they are now being addressed with a new urgency and 
frankness, impelled by the technological developments that make flight-deck 
automation entirely feasible, at least from an electromechanical point of 
view. 


2.1 A basic assumption 


One hears, from time to time, talk of the unmanned airline cockpit. 
Although the authors find this neither unthinkable or technologically 
infeasible, we feel that as far into the future as we can see, it would be 
socially and politically unacceptable. Therefore, while we do not completely 
dismiss the idea of an unmanned airliner, this discussion is based on the 
assumption that airliners will carry a human crew. For a concurring view, 
see McLucus (1978). Questions about the size, functions, selection, 
training, and motivation of this crew, however, remain open. It should be 
noted that even the unmanned factory, so often predicted, has never come to 
pass (de Jong and Koster 1974). 


2 . 2 Driv ing forces 


Before going further, one should ask just what is the thrust behind 
cockpit automation. We have identified three factors. 


2.2.1. Technology : The explosive growth of microprocessor technology 

has already been mentioned. Rapid improvement in performance and 
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decrease in size, cost, and power consumption of various 
electronic devices, sensors, and display media, make automation 
of many flight-deck (as well as ground-based) systems a 
reasonable alternative to traditional manual operation. This 
trend will continue well into the next century. One should note 
that technology is not a goal (as the next two factors are), but 
is instead a facilitating factor. 

2.2.2. Safety : More than half of the aircraft accidents are attributed 

to "human error." This term can be somewhat misleading, as one 
is never sure whether it means cockpit crew error or includes 
other humans, such as ATC controllers, weather forecasters, 
maintenance personnel, and dispatchers. Be that as it may, there 
exists ample need to reduce human error in the cockpit. 

Autopilots, flight directors, and alerting and warning systems 
are examples of automatic systems that have had a beneficial 
effect on pilot workload and on safety margins. The ground 
proximity warning system (GPWS) provides an excellent example. 
Since its introduction by Congressional mandate in 1974, there 
has been a dramatic reduction in terrain-strike accidents, both 
in the United States and worldwide. It is impossible to know 

how many aircraft and lives have been saved by this device. None- 
theless, it is often denounced by pilots for the frequent false 
alarms it generates. These false alarms are annoying and poten- 
tially dangerous, but on balance, the GPWS would have to be 
viewed very favorably. 

2.2.3. Economics : Undoubtedly, automation can bring about enormous 

savings through fuel conservation, if total flight time can be 
reduced and if more fuel -efficient climb and descent patterns 
can be implemented (Curry 1979; Feazel 1980). Both the potential 
for dollar savings and the effect on airline profits are 
difficult to exaggerate, especially in the face of steadily 
rising fuel prices. In 1978 a gallon of jet fuel sold for about 
38 cents (U.S.), for 70 cents by the end of 1979, and is fore- 
cast to be more than one dollar by the end of 1980. A recent 
analysis of the operating costs and profits of a major U.S. 
carrier showed that a 3% savings in jet fuel could res lit in a 
23% increase in profits. Automation in both ATC and the cockpit 
could easily produce the 3% reduction in fuel consumption; even 
greater savings are possible on shorter runs, such as the New 
York to Boston shuttle. Potter (1980) reported that every 
percentage point increase in jet fuel price will cost Western 
Airlines $4,000,000. Likewise, we presume, every percentage 
point by which consumption can be reduced should save the 
company about the same amount. Finally, Covey et al. (1979), who 
summarized 12 fuel conservation methods, have concluded that a 
savings of up to 12% could be realized from their optimal use. 

Five percent savings have already resulted from a partial im- 
plementation. Most of the methods they outlined would require 
automation to some degree in order to achieve maximum savings. 
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As in other industries, a large component of airline 
operating costs is labor. Although it is questionable whether 
automation can reduce the number of persons in the cockpit (the 
authors do not wish to plunge into the two-versus-three person 
crew controversy at this time), it is a possibility that should 
not be totally discounted (O'Lone 1980). 

Furthermore, automation may reduce direct labor costs some- 
what by reducing flight times through more efficient lateral 
navigation, and may cut maintenance costs by more effective use 
of the equipment. In considering economics, however, one must 
also recognize that automation equipment is expensive. The air- 
line industry will incur enormous capital costs to acquire the 
equipment, as well as operating costs for training and mainte- 
nance. But even putting the safety question aside and looking 
only at the economics, it appears at this time that flight-deck 
automation should be a very good investment, especially in view 
of continuing fuel price increases and possible shortages. 


3. Representative aviation accidents and incidents 


So much for the promises of flight-deck automation. Let us now examine 
some of the problems, which can best be illustrated by representative 
aviation accidents and incidents. These accounts are confined, by necessity, 
to very brief summaries and comments on what is usually a very complex 
causative chain. We do not wish to oversimplify either the facts or the 
causative interpretations of these accidents, and the interested reader is 
encouraged to read the full reports. For other examples, see Rolfe 1972, 
Danaher 1980, and Wiener 1977 and 1980. 


3 . 1 Failure of automatic equipment 


One of the concerns regarding the use of equipment for automatic 
control or monitoring is that it may fail to operate correctly. Consider 
the following incidents reported in a cockpit newsletter: 

1. In an approach with the autopilot in control, a bend in the glide- 
path at 500 ft above the ground caused a very marked pitch down, 
resulting in excessive sink rate. The pilot, though fully aware of 
the situation, did not react until his position was so critical 
that a very low pull-up had to be made. 

2. The altitude preselect (a device to level the aircraft at a pre- 
determined altitude) malfunctioned. This went unnoticed by the 
pilots and an excessive undershoot was made (descent below desired 
altitude) . 
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3. At level-off by use of the altitude preselect and with the 
throttles in idle (was autothrottle in use or expected?), the speed 
dropped close to the stall point before this condition wns detected 
and rectified by power application. 

4. While in navigation mode (autopilot steering the aircraft to 
maintain a track over the ground), the aircraft turned the wrong 
way over a checkpoint. Although the wrong turn was immediately 
noticed, the aircraft turned more than 45° before the pilot took 
action. 

These reports are brief, and the present authors do not have access to more 
details. Thus it is difficult to determine how much of the faul^ should be 
attributed to hardware failure, improper setup of the equipment, and 
inappropriate expectations of how the equipment should operate. Nonetheless, 
the reports are typical of the day-to-day problems encountered by 
flightcrews. 


3.2 Automat ion- induced error compounded by crew error 


The following accident illustrates one of the special hazards of 
automation, one that many traditional engineers might rather not hear about. 
In this case, the causative chain of events was set into motion by the 
failure of the automated equipment; the equipment error was then 
compounded by crew error, and a crash resulted (NTSB, 1979a). A Swift Aire 
Lines Nord 262 departed Los Angeles International westbound. Shortly after 
gear retraction, its right engine autof eathered. Autofeather is a device 
common on advanced twin-engine propeller-driven planes. It senses a loss of 
power in an engine and feathers the propeller automatically. It is armed 
only on takeoff and initial climbout. The purpose of the autofeather is to 
preclude the possibility that a crewmember will shut down the wrong engine 
in the event of power failure on takeoff. It remains for the crew to 
secure the dead engine, increase power on the operating engine, make trim 
and control adjustments, and continue climbing to a safe altitude for return 
to the field. 

Immediately after the right engine autof eathered, the crew shut down 
the left (operating) engine; the result was a fatal ditching in the Pacific 
Ocean. Examination of the right engine showed there had been no power loss, 
and the autofeather had been due to a broken hydraulic hose in the sensing 
mechanism. Later investigation revealed that inadvertent autofeathers on 
Nord 262 aircraft were not unusual. Thus, a device designed to automate 
human error out of the system had triggered a chain of events that was 
compounded by the very human error it was supposed to prevent. 
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3 . 3 Crev error in equipment s etup 


Inertial navigation systems (INS) are automatic navigators. They are 
also used to supply automatic pilots with position information to allow 
control of aircraft track (the navigation mode). A series of checkpoints, 
or waypcints, defining the desired track across the eartn, is loaded into 
the INS computer by keyboard before the flight by entering the waypoint 
latitude and longitude. The inertial navigation system aligns itself before 
flight and knows its accuracy status; since the accuracy increases during 
alignment, the INS will be less tolerant of errors in initial position. 
During the initial alignment, one crew loaded their position as a northern 
latitude rather than the actual southern latitude. The error was not 
detected by either the INS or the crew until after takeoff. The aircraft 
’ad to return to the departure point because the INS could not be reset in 
flight. 


3.4 Crew response to a false alarm 


Another form of automation-induced error is the false alarm, which 
persuades the crew to take corrective action when, in fact, nothing is 
wrong with the system (other than the spurious alarm). Such an error 
occurred during the takeoff of a Texas International DC-9 from Denver 
(NTSB, 1977). As the aircraft accelerated to the velocity of rotation 
(where the nose wheel is lifted off the runway and the aircraft assumes a 
nose-high pitch attitude), about 150 knots in this case, the stall warning 
actuated. This was a "stick shaker, tf a tactile warning system whereby the 
control column begins to shake, as well as to give auditory "c lacks. " 
Believing that a stall was imminent, in spite of normal airspeed and pitch 
attitude indications, the crew elected to abort the takeoff, resulting in a 
runway overrun, severe damage to the aircraft, and nonfatal injuries to 
some passengers. Interestingly, the pilots had both experienced spurious 
stall warnings on takeoff previously, but they probably had little choice 
but to regard this as a bona fide alert. 

In a "split second" the crew faced a choice between aborting the 
takeoff, with an almost inevitable, though perhaps noncatastrophic , 
accident, and continuing the takeoff with a plane that might not be flyable, 
which could result in a much worse accident. It might be interesting, but 
perhaps not highly profitable, to speculate on what might have occurred if 
this decision function had been automated. Suffice it to say that the 
decision to stop or go, as it f aced the crew at that critical moment during 
rotation, would have been in the hands of some distant software designer. 

We leave it to the reader to decide if that is a comforting thought. 
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3-5 Failure to heed automatic alarm 


An airline aircraft was on an approach to landing, but at an excessive 
airspeed. During the approach the ground proximity warning system was 
triggered three times (once for excessive descent rate, twice for less than 
26° flaps with gear extended and excessive descent rates). Instead of 
executing a missed approach, the captain continued toward landing, crossing 
the runway threshold at a speed of 184 knots, 61 knots above the reference 
speed. The aircraft landed approximately halfway down the runway and overran 
the far end; one person was injured seriously. 

The National Transportation Safety Board (179b) determined that the 
probable cause of the accident was the captain’s complete lack of awareness 
of airspeed, vertical speed, and aircraft performance throughout the 
approach and landing. A contributing factor was the copilot’s failure to 
provide required callouts of airspeed and vertical speed deviations. In its 
analysis, the NTSB did note that the GPWS alerts should have indicated to the 
crew that the approach was improper and that a missed approach was necessary. 
It also mentioned that none of the alerts caused the crew to take 
corrective action, even though company procedures dictated that they should 
do so. 


3.6 Failure to monitor 


This type of problem can be exemplified by certain "controlled flight 
into terrain" accidents, in which a flightcrew, with the aircraft totally 
under control, flies it into the ground (or water), usually without any 
prior awareness of impending disaster (see Ruffell Smith 1968; Wiener 1977). 
In December 1972, an Eastern Airlines L-1011 was approaching Miami on a clear 
night. During the prelanding cockpit check, the crew encountered an unsafe 
landing gear indication (light failed to illuminate). ATC assigned the air- 
craft to a westward heading at 2000 ft (mean sea level), while the crew 
attempted to diagnose the problem. The plane was under autopilot control. 

The flight crew became preoccupied with the problem at hand (the captain and 
first officer had pulled the bulb appliance out to check the lamp and were 
having trouble putting it back together). They did not notice that the 
autopilot had disengaged and that the aircraft was in a slow descending 
spiral. They flew into the ground, having never detected their departure 
from altitude, even with full cockpit instrumentation, extra-cockpit vision, 
a C-chiine altitude alert that sounded (and was present on the cockpit voice 
recorder), and an ambiguous inquiry from a radar operator in Miami who 
observed the descent on he alphanumeric readout on his set (NTSB, 1973). 


3.7 Loss of proficiency 


One of the most easily imagined consequences of automation is a loss 
of proficiency by the operator. Although there has been no specific accident 
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or incident in which such loss of flying proficiency has been cited as a 
contributing factor, individuals involved with pilot training have noted 
perceptible skill losses in pilous who use automatic equipment extensively. 
For example, copilots on wide body jets, which have sophisticated automatic 
systems, accrue enough seniority to become captains on narrow body jets, 
which do not have sophisticated autopilot-autothrottle systems. Those who 
report these skill losses go on to say that they feel they have resolved the 
problem by asking copilots to turn off the automatic systems prior to 
transition training so that they regain proficiency with manual systems. We 
have noticed that many crewmembers seem to have discovered this on their own 
and regularly turn off the autopilot, in order to retain their manual flying 
skills . 

Beyond the possible loss of proficiency, a change in attitude may be 
induced by use of automation. The following excerpt from a letter written 
by a flight training manager speaks succinctly of the issue: 

Having been actively involved in all areas of this training, one 
disturbing side effect of automation has appeared, i.e., a 
tendency to breed inactivity or complacency. 

For example, good conscientious First Officers (above average) 
with as little as 8-9 months on the highly sophisticated and 
automated L-lOlls have displayed this inactivity or complacency 
on reverting to the B-707 for initial command training. 

This problem has caused us to review and increase our command 
training time for such First Officers. In fact, we have doubled 
their allotted enroute training time. 


4. Common problem areas 


The previous discussions have concerned some very specific problems 
with the use of automated devices. We have analyzed the above incidents and 
many others and have tried to rephrase the problem statement into a more 
general context. Hopefully, this will assist interested parties from 
diverse disciplines and industries to communicate in a more effective manner. 
Five general problem areas are described below with some of the major issues 
outlined for each. As is to be expected, the boundaries of the problem areas 
are somewhat ill-defined, and many questions may legitimately belong to more 
than one category. 


4.1 Automation of control tasks 


This problem area has received the most attention in the past. When 
control tasks are automated, the operator* s role becomes one of a monitor 
and supervisor; hence, the primary issues revolve around his ability to 
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perforin these functions, since the control task is almost always ac- 
complished satisfactorily by the automatic system* Typical questions to be 
examined are: 

1. Under that conditions will the human acting as a monitor be a better 
(or worse) failure detector than the human as an active controller- 
operator? 

2* Is there a significant "warmup" delay when the human transitions 
from passive monitor to active controller? Does automation lull 
the operators into a state of low alertness or do they enter a state 
in which they are easily distracted from the monitoring task by 
un impor tan t events ? 

3. What should be the form of the interaction between the operator and 
the automatic system? If the automatic system is changing the 
system configuration, should it make the change automatically and 
inform the operator, or make the change only after operator 
acknowledgment? Should it tell the operator why it is making the 
change or not? 

4. What is the effect of different levels of equipment reliability on 
the operator's ability to detect, diagnose, and treat malfunctions 
in manual and automatic tasks? It seems plausible that equipment 
reliability could be an important factor. For example, if the 
equipment is very unreliable, then the operators will be expecting 
malfunctions and will be adept at handling them. If the equipment 
is very reliable, then there is little need for failure detection 
and diagnosis on the part of the operator. An intermediate level 

of reliability, however, mry be quite insidious since it will induce 
an impression of high reli. J.lity, and the operator may not be able 
to handle the failure when it occurs. 


4-2 Acquisition and retention of skills 


The use of automation will probably result in a decrease in the skill 
level for well-learned manual tasks. Of practical importance is the rate at 
which these skills deteriorate and the countermeasures available to prevent 
unacceptable skill loss. On the other hand, the training literature 
suggests that part-task operation (with the other tasks automated) during 
the early, familiarization phases of operation may be an effective means of 
total acquisition of operational skill. Thus, the major unanswered 
questions regarding the initial acquisition, reacquisition, and retention of 
skills are as follows: 

1. How quickly do manual skills deteriorate with lack of use? What 
factors influence the rate of loss? 
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2. Can periodic practice prevent skill deterioration? If so, what 
frequency is required? 

3. Are there alternatives for practice with the actual system, for 
example, part-task simulators? 

4. What quality control techniques will be necessary to assure 
maintenance of skills? 

5* Can automation be used to successfully increase the rate of skill 
acquisition in complex tasks by automating some of the subtasks? 
Will the operator who is learning in this mode be better at 
detecting anomalies in other parts of the process? Will the 
necessity of learning to operate the automatic equipment (perhaps 
a complex process itself) negate any of the gains of automating 
subtasks? 


4 * 3 Monito r ing of complex systems 


The. experimental and theoretical research on vigilance deals primarily 
with human perceptual processes; for example, detecting the presence of a 
light. Most systems, however, require much more cognitive processing to 
perform the monitoring task. For example, a typical pilot assessment of his 
fuel situation might proceed as follows: the aircraft is traveling at 

200 miles/hr and is 100 riles or 100 * 200 = 0.3 hr from the destination; 
it is burning fuel at the rate of 100 gal/hr and therefore requires 

0.3 * 100 or 30 gal to reach the destination; there are 40 gal of fuel 
remaining, sc the destination cannot be reached. 

Beyond this very simple but highly realistic case, there are many 
situations that require cognitive functions; for example, logical, 
mathematical, and memory operations utilizing multiple sources of informa- 
tion. The major issues in this complex monitoring are essentially those 
that confronted research ers in the vigilance area, but they have to be 
examined for the more complex situations. 

1. Does complex monitoring performance degrade with time on watch? If 
so, is this decrement perceptual, cognitive, or criterial? 

2. What are the means for maintaining operator alertness for rare 
signals? Will artificial signals and alerts improve or degrade 
monitoring effectiveness? Will additional workload, in addition to 
complex monitoring, improve or degrade performance? 

3. What makes an automatic system more ’’interpretable, " that is, 
easier to detect and diagnose malfunctions? 
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4.4 Alerting and warning systems 


Human behavior with alerting and warning systems is one of the most 
fascinating topics in man-machine interaction. It is here that one sees 
both unpredictable and predictable responses. For example, it has long been 
recognized that people will ignore an alarm if experience has shown that the 
alarm may be false (the boy who cried wolf); we see the same behavior with 
some cockpit alarms today. Important research questions for alerting and 
warning systems include: 

1. What are the characteristics of an ideal (but attainable) alerting 
and warning system? 

2. What attributes make a false alarm rate unacceptably high? 

3. Why do alarms apparently go unheeded? 

4. Under what conditions do operators rely on alerting and warning 
systems as primary devices rather than as backup devices? Is this 
operationally sound? 

5. Under what conditions will operators check the validity of an 
alarm? 

6. Should the responsible optrator be given a preview alert and 
opportunity for corrective action before the alarm is given to 
others? 

7. A consensus seems to be building to develop alerting and warning 
systems that are ’’smart"; among other things, they would prevent 
’’obvious" false alarms and prioritize alarms. The logic for these 
systems will likely >e exceedingly complicated. Will that logic 
be too complex fcir operators to perform validity checks, and thus 
lead to over-reliance on the system? Will the priorities always 
be appropriate? It not, will the operators recognize this? 

4.5 Psychosocial aspects of automation 


The j^ychosocial aspects of automation may prove to be the most 
important* f all, because they influence the basic attitudes of the operator 
toward his task and, we would presume, his motivation, adaptability, and 
responsiveness. The significance of these questions lies not in the spectre 
of massive unemployment due to assembly line automation, but in the effects 
of automation on the changing role of a few highly skilled operators. 

1. Will automation influence job satisfaction, prestige, and self- 
concept (especially in aviation)? 
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2. If there are negative psychosocial consequences of automation, what 
precautions and/or remedies will be effective without changing the 
use of automation? 

3. What does increased automation imply for operator selection? Are 
there clearly defined aptitudes or personality attributes that imply 
better monitoring (or manual) effectiveness? 

4. How should training programs be altered to deal with possible 
psychosocial effects? Would a simulator help support morale? If 
so, what type of simulation? 

5. Design decisions 

The words -'cockpit automation" are usually interpreted to mean auto- 
pilots, flight directors, and other equipment associated with Che control of 
the aircraft flightpath. Interpreting automation to mean the accomplishment 
of a task by a machine instead of a human leads to the realization that all 
cockpit alerting and warning systems are forms of automation also, since they 
perform monitoring tasks. Automation of control and automation of monitoring 
are quite independent of one another; it is possible to have various levels of 
automation in one dimension (see figure 1) independent of the other. Automa- 
tion of control tasks implies that the operator is monitoring the computer, 
whereas automation of the monitoring tasks implies that the computer is mon- 
itoring the operator. Both of these dimensions will be explored in the con- 
text of design decisions after a discussion of the overall goals of the system. 



• FATIGUE 

Figure 1.- Two dimensions of automation: control and monitoring. 
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5.1 System goals 


Let us begin by asking what the user expects of the system. Some of the 
goals of the system are: 

1. To provide a flight (from pushback to docking) with infinitesimal 
ace ident probab i 1 ity . 

2. To provide passengers with the smoothest t ssible flight (by weather 
avoidance, selection of the least turbulent altitudes, gradual 
turns and pitch changes, and gradual altitude changes). 

3. To conduct the flight as economically as possible, minimizing flight 
time, ground delays, fuel consumption, and wear on the equipment. 

4. To minimize the effect of any flight on the ability of other air- 
craft to achieve the same goals (e.g., by cooperation with ATC in 
rapidly departing altitudes when cleared, freeing them up for other 
aircraft) . 

5. To provide a pleasant, safe, and healthful working environment for 
the crew. 

Now that tiie goals of the system have been annunciated, several things 
should he clear. First, the goals are exactly the same whether the systems 
are automated or manual. Whether flight-deck automat ion can help achieve 
these goals, and whether it is feasible and economical to do so, remains to 
be seen. (For a totally optimistic view, see Boulanger and Pa i 
Second, for the most part, these g *a 1 s are not in conflict. There are 
exceptions; for example, it is c' oar that (2) above may be in conflict with 
(3). The resolution of this c inflict lies in evaluating the utilities to 
the airline, no easy job in itself. If the utilities can he made explicit, 
then the resolution could he automated. For example, one could envision an 
onboard flight management svste; that would take into account the utilities 
of extra cost of weather avoidance versus the discomfort to passengers. The 
system would then, within certain constraints, navigate over a course and 
altitude of maximum utility. If the reader prefers, let him substitute 
"recommend to the crew" for "navigate over." Likewise, (2) and (4) may at 
times he in conflict — a very rapid descent would he helpful to ATC in 
clearing altitude for other traffic, but may adversely affect both 
passenger comfort and fuel consumption. Again, while these are not problems 
of automation per s<e, automation in the cockpit (and elsewhere) may aid in 
their resolution, forcing the designer to face the question of utilities. 


5 . 2 Design philosophies — cent ro l 


So far we have specified system goals and constructed, at least, a 
justification for considering automation as a means to reaching those goals. 
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along with some cautions. We must now consider design philosophies centered 
on the man-in-the-loop question. In simple terms, the designer must ask tc 
what extent the human should be included in the control loop at all (Sinaiko 
1972). 

This is considerably more than restating the time-honored cliches about 
ft Man can do these things better than machines* but machines can do these 
bet ter * M which were so in fashion in the early days of ergonomics. Since 
the authors have already ruled out unmanned airline flight (by assumption)* 
the question must now be restated* "Under what conditions should man be part 
of the control loop, and what price is paid, in terms of attaining system 
goals* for including or excluding him?" One paridigm is diagrammed in a 
paper by Johannsen (1976). His scheme envisions nested control loops* with 
inanimate devices controlling the inner (high bandwidth) loops, and an 
outward progression toward lower bandwidth, where the human is inserted as 
controller-monitor . 

Using this framework, let us imagine the control of a typical flight. 

An example of the highest bandwidth control task is yaw damping, to prevent 
the aircraft from entering an oscillatory "Dutch roll" mode. This activity 
is usually beyond the frequency domain of the human and is thus assigned to 
an automatic control device, a yaw damper, one that is built in and un- 
regulated by the flightcrew. 

Progressing outward, one encounters the moment-to-moment directional 
control of the aircraft — which can be either hand-flown or handled by 
autopilot. At cruise, the least critical portion of the flight, designers 
and pilots are only too happy to turn control over to the autopilot, 
allowing the flightcrew to occupy themselves with other things. In the more 
critical segments of the flight, use or nonuse of the autopilot is largely 
a matter of personal style of the flightcrew. 

Control of the autopilot during level flight at an assigned altitude 
would be a happy state of affairs were it not for the fact that autopilots 
have a disconcerting way of failing "gracefully," so gracefully that a 
decoupling may not be noticed by the crew until the system is badly out of 
limits, if then. Two interesting examples can be cited. First, a PAA 
B-707, which was cruising at 36,000 ft above the Atlantic, experienced a 
graceful autopilot disengage. The aircraft, which vent into a steep 
descending spiral before the crew took action, lost 30,000 ft before 
recovery (Wiener 1962). A second case, the crash of an Eastern Airlines 
L-1011 in the Everglades, was discussed in Section 3.6. 

Continuing outward, the next loop might be navigation (lateral and 
vertical), where from time to time heading changes would affect directional 
control, and pitch and power changes would affect the vertical position. In 
more advanced autopilot /flight-management systems, much of this (at least the 
lateral portion) can be preprogrammed. Alternatively, the man in the loop 
could use his autopilot (or manual controls) to make the necessary changes. 

A more demanding control task would be final approach navigation — merely 
a special case of lateral and vertical navigation, but one that combines 
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relatively high bandwidth with low error tolerance. At this point, the 
man-in-the-loop design philosophies become controversial. 

An excellent example of the intrusion of basic design philosophy into 
equipment concepts is the conti oversy that continues to swirl around the 
head-up display (HUD). At issue is the HUD's utilit> for aiding the pilot 
making a lo -ceiling, low-visibility approach, below those permitted with 
conventional head-down displays, even when aided by autcchrot ties and flight 
directors. The two philosophies are exemplified in a paper by Naish and Von 
Wieser (1969), which was strongly supportive cf retaining the man in the loop 
by means of providing a HUD, and by St. John (1963) who wished to 1 move 
the man entirely from controlling a final approach by using more sophisti- 
cated autoland equipment. The argument in favor of the HUD is that it 
allows one crewmember to remain "head up,” so that when the runway becomes 
visible, the transition from instruments to outside reference is facilitated. 
The ,f head up" pilot would then fly so as to visually superimpose the HUD 
runway symbology on the actual runway. 

Others feel that the intervention by the pilots could introduce nothing 
but error to an autoland approach — they prefer to have the autopilot- 
autothrottle capacity used all the way to the runway, with the pilots 
keeping hands off and only monitoring (as in the extreme lower right of 
figure 1). The middle ground would be an autoland approach monitored by a 
headup display. This procedure is gaining favor and is currently 
operational on some European carriers. 

The reader should note that at least one piece of cockpit instrumenta- 
tion, the flight dir<ctor, stands in contrast to the nested-loop con- 
figuration we have been describing. A flight director takes essentially 
outer-loop decisions about navigation and computes steering commands for the 
pilot (or autopilot), relieving him of complex information processing 
requirements . 

Finally, one might conceive of outermost loops where control decisions 
are made only occasionally — initial flight planning or enroute changes 
(such as weather avoidance, diversion to an alternate destination, or 
handling of critical in-flight events). Many such decisions could be 
automated, but presently are not. We predict that the actual decisions 
would always remain in the domain of the pilot for a variety of reasons: 
complexity, the cost of developing and maintaining software, legal liability, 
and social pressures, just to name a few. Even in the most fully automatic 
mode, the equipment would process information and present alternatives to 
the pilot, who would weigh the results and make the command decision. The 
intriguing question is the many forms the crew- computer interaction might 
take. For example, does the automatic equipment merely compute 
alternatives, or should it suggest a "best” choice to the pilot? What role 
could automation play in multi-attribute decisions? Let us take, as an 
example, the choice of an alternate airport if it becomes necessary to 
divert. Pertinent attributes of the candidate airports include the present 
weather, the forecast weather, type of instrument approach available, 
passenger facilities, maintenance facilities, runway length and conditions. 
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fuel cost at the destination, surrounding terrain, and many more. Auto- 
mation or not, the captain must ultimately process multidimensional 
information and make a decision, often between conflicting objective 
functions. Our question, once again, is how may automation assist the pilot 
in making his decision? 


5 . 3 Design philosophies — monitoring 


Until recently, there has been little consensus on a design philosophy 
for automatic alerting and warning systems other than to install a warning 
device to alert the pilot to a condition that existed in some recent and 
serious accident. This, and the desire to cover all situations with alerts 
or warnings, has led to a proliferation of independent warning and alerting 
devices which many feel has reached the point of saturating pilot informa- 
tion processing capabilities (Randle et al. 1980). For example, there are 
188 warnings and caution alerts on the B-707, 455 on the B-747, 172 on the 
DC-8, and 418 on the DC-10. The aviation industry seems to feel that the 
time has come for the development of integrated alerting and warning systems 
(Cooper 1977). 

It has been stated that man is a poor monitor, yet for detecting some 
situations (e.g., incapacitation or aberrant behavior of other crewmembers) 
man is clearly superior to any automatic monitor. If he does have 
monitoring difficulty in large transport aircraft, it would appear to arise 
from the requirement that he monitor a large number of systems and perform 
other duties at the same time. In spite of many laboratory studies showing 
the parallel processing capabilities of the human, pilots generally perform 
many of their tasks as single-channel processors, especially when a task is 
somewhat out of the ordinary. It is not uncommon, for example, to see 
pilots concentrate on lateral navigation during a difficult intercept 
maneuver to the exclusion of airspeed control. 

In summary, the primary necessity for automation of the monitoring 
functions Is the single-channel behavior of the human and the increased 
number of devices or conditions to be monitored. Increasing the number of 
individual alerts and warnings is not the complete answer to the problem, 
however, since one anomaly may lead to a large number of alerts, many of 
which are superfluous or, worse, misleading; thus, the industry emphasis on 
integrated alerting and warning systems (Randle et a_l . 1980). 


5.4 Strengths and weaknesses 


At the risk of stumbling into the trap of "Man does this better, 
machines do this better,” the authors close this section by summarizing and 
generalizing about some of the positive and negative features of cockpit 
automation. The generalizations contained in table 1 probably apply to the 
flight deck, and may apply equally well to manufacturing, ATC, medicine. 


17 



TABLE 1.- GENERALIZATIONS ABOUT ADVANTAGES AND DISADVANTAGES OF AUTOMATING MAN-MACHINE SYSTEMS. 
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(e.g., software 
error resulting 
in an accident) 




telecommunications, power generation, and many nonaviation examples of highly 
automated systems. Our focus, of course, is on the flight deck. 


6. Automation guidelines 


In this section we propose some guidelines for designing and using (or 
not using) automated systems. These guidelines should be considered in 
addition to the usual human factors engineering requirements. The guide- 
lines are not to be considered as specifications, since most lack the 
detail needed for that purpose, and conditions exist where they may not be 
appropriate. Moreover, there are many conflicting concepts within these 
guidelines. Because we have tried to make them comprehensive, some may 
appear to the reader to be quite obvious. 


6.1 Control tasks 


1. System operation should be easily interpretable or understandable 
by the operator to facilitate the detection of improper operation 
and to facilitate the diagnosis of malfunctions. 

2. Design the automatic system to perform the task the way the user 
wants it done (consistent with other constraints such as safety) ; 
this may require user control of certain parameters, such as system 
gains (see guideline 7). Many users of automated systems find that 
the systems do not perform the function in the manner desired by 
the operator. For example, autopilots, especially older designs, 
have too much "wing waggle" for passenger comfort when tracking 
ground-based navigation stations. Thus, many airline pilots do not 
use this feature, even when traveling coast to coast on nonstop 
flights. 

3. Design the automation to prevent peak levels of task demand from 
becoming excessive (this may vary from operator to operator). 

System monitoring is not only a legitimate, but a necessary 
activity of the human operator; however, it generally is second in 
priority to other, event-driven tasks. Keeping task demand at 
reasonable levels will ensure available time for monitoring. 

4. For most complex systems, it is very difficult for the computer to 
sense when the task demands on the operator are too high. Thus, 
the operator must be trained and motivated to use automation as an 
additional resource (i.e., as a helper). 

5. Operators should be trained, motivated, and evaluated to monitor 
effectively. 
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15. Devise training techniques and possibly training hardware (including 
part- and whole-task simulators) to insure that flightcrews are 
exposed to all forms of alerts and to many of the possible 
combinations of alerts, and that they understand how to deal with 
them. 


7. Conclusions 


There are many potential safety and economic benefits to be realized by 
automating cockpit functions, but the rapid pace of automation is out- 
stripping one’s ability to comprehend all the implications for crew per- 
formance. It is unrealistic to call for a halt to cockpit automation until 
the manifestations are completely understood. We do, however, call for those 
designing, analyzing, and installing automatic systems in the cockpit to do 
so carefully; to recognize the behavioral effects of automation; to avail 
themselves of present and future guidelines; and to be watchful for 
symptoms that might appear in training and operational settings. The 
ergonomic nature of these problems suggests that other sectors of aviation 
and, indeed, other industries, are or will be facing the same problems. 


PREC£ding bunk NOT FILM to 
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